It appears that Google now requires a button push on the phone when verifying a log in. This is new to me. It asked me to hit the volume down button to verify my sign in. I was signing into a new chromebook at the time.
I assume that is more secure? If someone controlled your phone I would think they also might have the ability to simulate a volume down press as well? Whatever it is I sure wish I would have taken a screenshot.